Lucene search

K
nessusThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.F5_BIGIP_SOL94778122.NASL
HistoryNov 02, 2017 - 12:00 a.m.

F5 Networks BIG-IP : tcpdump vulnerabilities (K94778122)

2017-11-0200:00:00
This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
15

CVE-2016-7985

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

CVE-2016-7992 The Classical IP over ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-cip.c:cip_if_print().

CVE-2016-7993 A bug in util-print.c:relts_print() in tcpdump before 4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS, DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

CVE-2016-8574 The FRF.15 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:frf15_print().

CVE-2016-8575 The Q.933 parser in tcpdump before 4.9.0 has a buffer overflow in print-fr.c:q933_print(), a different vulnerability than CVE-2017-5482.

Impact

An attacker can gain access to sensitive information. An attacker can also cause a denial of service (DoS) by way of a crafted pcap file or by sending specially crafted packets to the network segment where tcpdump is actively capturing network traffic. The tcpdump program does not use the protocol decoding subsystem and is therefore not affected by these vulnerabilities when using the -w option to write raw packets to a pcap file for offline examination.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from F5 Networks BIG-IP Solution K94778122.
#
# The text description of this plugin is (C) F5 Networks.
#

include("compat.inc");

if (description)
{
  script_id(104342);
  script_version("3.10");
  script_cvs_date("Date: 2019/01/04 10:03:41");

  script_cve_id("CVE-2016-7985", "CVE-2016-7992", "CVE-2016-7993", "CVE-2016-8574", "CVE-2016-8575", "CVE-2017-5482");

  script_name(english:"F5 Networks BIG-IP : tcpdump vulnerabilities (K94778122)");
  script_summary(english:"Checks the BIG-IP version.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote device is missing a vendor-supplied security patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"CVE-2016-7985

The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in
print-calm-fast.c:calm_fast_print().

CVE-2016-7992 The Classical IP over ATM parser in tcpdump before 4.9.0
has a buffer overflow in print-cip.c:cip_if_print().

CVE-2016-7993 A bug in util-print.c:relts_print() in tcpdump before
4.9.0 could cause a buffer overflow in multiple protocol parsers (DNS,
DVMRP, HSRP, IGMP, lightweight resolver protocol, PIM).

CVE-2016-8574 The FRF.15 parser in tcpdump before 4.9.0 has a buffer
overflow in print-fr.c:frf15_print().

CVE-2016-8575 The Q.933 parser in tcpdump before 4.9.0 has a buffer
overflow in print-fr.c:q933_print(), a different vulnerability than
CVE-2017-5482.

Impact

An attacker can gain access to sensitive information. An attacker can
also cause a denial of service (DoS) by way of a crafted pcap file or
by sending specially crafted packets to the network segment where
tcpdump is actively capturing network traffic. The tcpdump program
does not use the protocol decoding subsystem and is therefore not
affected by these vulnerabilities when using the -w option to write
raw packets to a pcap file for offline examination."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://support.f5.com/csp/article/K94778122"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade to one of the non-vulnerable versions listed in the F5
Solution K94778122."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_access_policy_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_advanced_firewall_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_acceleration_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_security_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_application_visibility_and_reporting");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_global_traffic_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_link_controller");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_local_traffic_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_policy_enforcement_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:f5:big-ip_webaccelerator");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:f5:big-ip_protocol_security_manager");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/03/07");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/02");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"F5 Networks Local Security Checks");

  script_dependencies("f5_bigip_detect.nbin");
  script_require_keys("Host/local_checks_enabled", "Host/BIG-IP/hotfix", "Host/BIG-IP/modules", "Host/BIG-IP/version", "Settings/ParanoidReport");

  exit(0);
}


include("f5_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
version = get_kb_item("Host/BIG-IP/version");
if ( ! version ) audit(AUDIT_OS_NOT, "F5 Networks BIG-IP");
if ( isnull(get_kb_item("Host/BIG-IP/hotfix")) ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/hotfix");
if ( ! get_kb_item("Host/BIG-IP/modules") ) audit(AUDIT_KB_MISSING, "Host/BIG-IP/modules");

sol = "K94778122";
vmatrix = make_array();

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# AFM
vmatrix["AFM"] = make_array();
vmatrix["AFM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5");
vmatrix["AFM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# AM
vmatrix["AM"] = make_array();
vmatrix["AM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5");
vmatrix["AM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# APM
vmatrix["APM"] = make_array();
vmatrix["APM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["APM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# ASM
vmatrix["ASM"] = make_array();
vmatrix["ASM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["ASM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# AVR
vmatrix["AVR"] = make_array();
vmatrix["AVR"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["AVR"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# GTM
vmatrix["GTM"] = make_array();
vmatrix["GTM"]["affected"  ] = make_list("11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["GTM"]["unaffected"] = make_list("11.6.2-11.6.3","11.5.6");

# LC
vmatrix["LC"] = make_array();
vmatrix["LC"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["LC"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# LTM
vmatrix["LTM"] = make_array();
vmatrix["LTM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5","11.2.1");
vmatrix["LTM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");

# PEM
vmatrix["PEM"] = make_array();
vmatrix["PEM"]["affected"  ] = make_list("13.0.0","12.0.0-12.1.2","11.6.0-11.6.1","11.4.0-11.5.5");
vmatrix["PEM"]["unaffected"] = make_list("13.1.0","13.0.1","12.1.3","11.6.2-11.6.3","11.5.6");


if (bigip_is_affected(vmatrix:vmatrix, sol:sol))
{
  if (report_verbosity > 0) security_hole(port:0, extra:bigip_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = bigip_get_tested_modules();
  audit_extra = "For BIG-IP module(s) " + tested + ",";
  if (tested) audit(AUDIT_INST_VER_NOT_VULN, audit_extra, version);
  else audit(AUDIT_HOST_NOT, "running any of the affected modules");
}
VendorProductVersionCPE
f5big-ip_application_acceleration_managercpe:/a:f5:big-ip_application_acceleration_manager
f5big-ip_application_security_managercpe:/a:f5:big-ip_application_security_manager
f5big-ip_application_visibility_and_reportingcpe:/a:f5:big-ip_application_visibility_and_reporting
f5big-ip_global_traffic_managercpe:/a:f5:big-ip_global_traffic_manager
f5big-ip_link_controllercpe:/a:f5:big-ip_link_controller
f5big-ip_local_traffic_managercpe:/a:f5:big-ip_local_traffic_manager
f5big-ip_policy_enforcement_managercpe:/a:f5:big-ip_policy_enforcement_manager
f5big-ip_webacceleratorcpe:/a:f5:big-ip_webaccelerator
f5big-ipcpe:/h:f5:big-ip
f5big-ip_protocol_security_managercpe:/h:f5:big-ip_protocol_security_manager
Rows per page:
1-10 of 121